Users can now define custom regex patterns for proprietary token formats,
internal URLs with keys, or any secret the built-in scanner doesn't cover.
Patterns are added/toggled/removed from the Options page and apply to both
the live interception (content.js) and the Test tab (popup.js).
Renamed all user-facing "Secret scanning" labels to "Auto Redact" across
popup and options. Internal variable names (secretScanning, SecretScanner)
kept for backwards compatibility with stored settings.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
- Edit domains inline (pencil icon, saves on Enter)
- Suggested domains: clickable chips for popular AI/dev/collab sites
- Bulk add: paste multiple domains at once (one per line or comma-separated)
- Popup domain management: add/remove/suggestions directly from the popup
- Permission revoke on removal + suggested list updates dynamically
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Popup:
- Added 5th "Options" tab with key settings accessible without
opening the full options page: secret scanning, auto-detect PPI,
auto-redact, show highlights, document scan preview
- "Open Full Options Page" button for sync/encryption/org/import
- Settings changes in popup immediately broadcast to content scripts
Safari:
- Added build-safari.sh that uses Apple's safari-web-extension-converter
to generate an Xcode project from the Firefox build
- browser-polyfill.js already handles Safari (uses browser.* like Firefox)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Fixed safeHTML in all three files — template.content.childNodes and
doc.body.childNodes are live NodeLists that shrink as nodes are moved.
Using Array.from() to create a static copy before spreading into
replaceChildren().
Expanded proper noun common words filter with ~500 additional verbs,
nouns, and adjectives (generate, design, manage, process, account,
button, dashboard, etc.) to prevent false PPI flags on titles,
headings, and UI button labels.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Replaced all 31 innerHTML assignments across popup.js (12),
options.js (17), and content.js (3) to pass Mozilla AMO linter.
Each file gets a safeHTML(el, html) helper:
- popup.js/options.js: DOMParser-based (extension page context)
- content.js: <template> element pattern (page world context)
Empty innerHTML clears replaced with el.replaceChildren().
innerHTML += replaced with createElement + safeHTML + appendChild.
All event listener bindings after HTML rebuilds remain functional
since safeHTML uses replaceChildren() which populates DOM
synchronously before querySelectorAll + addEventListener calls.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Passwords imported from password managers are now:
- Displayed as dots (••••••••) by default in both options and popup
- Separated into their own "Passwords" section in options page
- Only revealable by entering the vault encryption password
- Always masked in the popup mappings list (no reveal there)
Options page:
- New Passwords section with locked/unlocked states
- Reveal button validates against vault encryption password
- Hide button re-masks all password values
- Password mappings excluded from the general Mappings table
- Delete and enable/disable controls work while masked
Popup:
- Password-category mappings show dots for real value
- Password category added to mapping add form dropdown
Storage:
- Added 'password' to default categories list
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
All sensitive data (identity, mappings, activity log) is now AES-256
encrypted in browser.storage.local when sync encryption is enabled.
TOTP secret is also encrypted at rest using the derived key.
Vault unlock flow:
- On browser restart, extension detects locked state (encrypted data,
no cached CryptoKey) and shows LOCK badge in red
- Popup shows a full-screen unlock prompt with password field,
optional TOTP, and biometric button
- After unlock, background decrypts and broadcasts data to all tabs
- Content scripts start with empty config when locked; receive
decrypted config via vault:unlocked message after unlock
- Injector skips encrypted blobs in storage change events
Storage module changes:
- _readSecure / _writeSecure transparently encrypt/decrypt
- encryptExistingData() migrates plaintext → encrypted on setup
- decryptAllData() restores plaintext when encryption is disabled
- isLocked() checks for encrypted data + missing key
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Scans outbound messages AFTER all substitutions for personal data
the user forgot to configure:
- Private/public IP addresses (skips 127.0.0.1, 8.8.8.8, etc.)
- MAC addresses
- Street addresses ("123 Main St")
- GPS coordinates
- Dates (possible DOBs)
- EIN/tax IDs
- Home directory paths not caught by smart patterns
- Shell prompts (user@host)
- Git remotes (reveals username/org)
- Environment variable assignments (HOME=, USER=, etc.)
Shows a floating dark warning banner (top-right, auto-dismisses
after 15s) listing each detected item with its type, value, and
hint. Skips values already in the user's identity config.
Also shows PPI warnings in the popup Test tab and adds toggle
in Options to disable auto-detect.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
- Pressing Enter in any identity field saves immediately
- Save button shows "Save Identity *" (orange) when there are
unsaved changes, flashes "Saved!" (green) on save
- New profiles start with empty First and Last name rows
pre-populated so users know what to fill in
- Input changes in the identity tab are tracked to show
saved/unsaved state
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Identity fields now support multiple entries per type:
- Add unlimited names (first, last, middle, nickname), emails,
usernames, hostnames, and phone numbers per profile
- "+ Add" button on each section, "x" to remove rows
- Names have a type selector (1st/Last/Mid/Nick)
README now includes:
- First-time setup walkthrough (step by step)
- Icon color legend (gray/black/blue/red)
- Keyboard shortcuts table
- Note that extension does nothing until configured
Also bumps version to 0.3.0 for Firefox re-signing.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Identity tab now supports multiple named profiles:
- Dropdown selector to switch between profiles
- "+" button to add a new profile (prompts for name)
- Pencil button to rename
- X button to delete (can't delete the last one)
- Toggle to enable/disable each profile independently
Default profile is "Personal". All active profiles are merged
and substituted simultaneously — so "Personal" (your name) and
"Work" (your work email, company domain) both get caught.
Storage model: profiles are stored as an array under ss_identity.
getIdentity() merges all active profiles into a single identity
object for the substitution engine.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Users can now label mappings as 'domain' (e.g. mycompany.com →
example.com). This is a category label for organization — the
substitution works the same as any other mapping.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Shows a red warning banner at the top of the popup when no identity,
email, username, or explicit mappings are configured. The status dot
turns orange (instead of green) to indicate the extension is active
but not protecting anything yet. Banner disappears as soon as the
user saves their identity.
Prevents users from thinking they're protected when nothing has
been configured.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Adds a secret scanning layer that runs after identity/explicit
substitutions. Catches secrets the user didn't configure:
- API keys: OpenAI (sk-), Anthropic (sk-ant-), Google (AIza),
AWS (AKIA), GitHub (ghp_), GitLab (glpat-), Slack (xox),
Stripe (sk_live/test), SendGrid (SG.)
- Auth: Bearer tokens, key=value assignments (password=, secret=,
api_key=, token=), private key blocks (-----BEGIN PRIVATE KEY-----)
- Connection strings: mongodb://, postgres://, mysql:// with creds
- PII: SSN (xxx-xx-xxxx), credit card numbers (Visa/MC/Amex/Discover)
Redacted values shown in red in the Test tab. Secrets are truncated
in the activity log (first 8 chars + "...") to avoid logging the
full secret. Enabled by default, toggle in Options.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Users will stop checking once they trust the tool. Be upfront that
it can miss PPI in images, file uploads, unusual name variations,
or unconfigured data. Yellow warning box in the popup footer.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Reveal mode (eye icon) now works as intended:
- Toggle ON: all existing responses on the page get fake→real
substitution applied immediately (paths, names, emails, etc.)
- Streaming responses are revealed in real-time as they arrive
- Toggle OFF: original text is restored from saved state
- Covers code blocks, artifacts, pre tags, and all response
containers across all supported services
- Blue floating badge shows "Reveal Mode — showing real data"
when active so user knows what they're seeing
The workflow is now: type /home/jsmith/... → Claude sees
/home/ademo/... → Claude responds with /home/ademo/... →
reveal mode shows /home/jsmith/... → user copies real path.
Also adds privacy note in popup footer: data stays in local
browser storage, no servers, no tracking, no analytics.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Test tab now has two modes:
- Strip (real → fake): paste text with real data, see what gets sent
- Reveal (fake → real): paste AI output with fake data, get back
real data with a "Copy to Clipboard" button
Also fixes:
- content.js smartSubstitute bailing when identity.enabled was
undefined (defaulted enabled to all-true instead of returning)
- Test tab now reloads identity from storage on tab switch so
changes saved in the Identity tab take effect immediately
- Shows yellow warning when identity fields are missing
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Extend Silent Send to intercept API requests on all major AI chat
services. Each service has different API shapes:
- ChatGPT: /backend-api/conversation with content.parts arrays
- Grok: GraphQL + /2/grok/add_response with message field
- Gemini: form-encoded f.req with nested arrays (+ generateContent)
- OpenWebUI: /api/chat and /ollama/api/chat (self-hosted)
All services share the same substitution pipeline. Manifests updated
for both Chrome and Firefox with host_permissions for all domains.
OpenWebUI supported via localhost/127.0.0.1 for self-hosted instances.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
jsmith@macbook-pro now becomes ademo@mycomputer when both username
and hostname are configured in the Identity tab. Hostnames are also
caught standalone (e.g. just "macbook-pro" in text).
Also rewrites README with detailed step-by-step Mozilla API key
setup instructions for Firefox signing.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Instead of requiring explicit mappings for every variation, users
now configure their identity once (Identity tab) and Silent Send
auto-catches:
- Emails: any address @gmail, @yahoo, @outlook, etc.
- Names: first/last, full name, reversed, possessives, case variants
- Usernames: user@host, ~user, /home/user, C:\Users\user
- Phones: all common formats ((555) 123-4567, 555.123.4567, etc.)
Smart patterns run before explicit mappings, so explicit rules
can override smart catches when needed.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Add manifest.firefox.json for Firefox MV3 (gecko ID, background
scripts instead of service_worker, options_ui). Introduce
browser-polyfill.js shim so all modules use whichever API is
available (browser.* or chrome.*). Add build.sh to target
chrome, firefox, or both.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Chrome Manifest V3 extension that intercepts personal data and
substitutes it with user-defined replacements before sending to
Claude.ai. Hooks fetch() in the page's main world to catch API
requests, with bidirectional substitution (real→fake on send,
fake→real on display via reveal mode).
Includes popup UI with mapping management, live test/diff view,
activity log with badge count, options page with import/export,
and Shadow DOM traversal for Claude.ai compatibility.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude